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In quantum key distribution (QKD), the bit error rate is used to estimate the information leakage 
and hence determines the amount of privacy amplification — making the final key private by short¬ 
ening the key. In general, there exists a threshold of the error rate for each scheme, above which 
no secure key can be generated. This threshold puts a restriction on the environment noises. For 
example, a widely used QKD protocol — BB84 — cannot tolerate error rates beyond 25%. A new 
protocol, round-robin differential phase shifted (RRDPS) QKD, essentially removes this restriction 
and can in principle tolerate more environment disturbance. Here, we propose and experimentally 
demonstrate a passive RRDPS QKD scheme. In particular, our 500 MHz passive RRDPS QKD 
system is able to generate a secure key over 50 km with a bit error rate as high as 29%. This scheme 
should find its applications in noisy environment conditions. 


The uncertainty principle guarantees that whenever an 
eavesdropper, Eve wants to learn key information in the 
quantum channel, she would inevitably introduce distur¬ 
bances, which could be detected by the two authorized 
parties, Alice and Bob. In reality, the quantum channel 
may suffer from environment disturbance, which could 
cause errors and even more vitally conceal Eve’s attack. 

The amount of leaked key information, which is quanti¬ 
fied by a phase error e p , can be inferred from the channel 
disturbance, which is quantified by a bit error e&. The 
final key rate is given by p], 

R>l-H(e b )-H(e p ), (1) 

where H(e) = —eloge — (1 — e) log(l — e) is the binary 
Shannon entropy function. The bit error can be directly 
computed from the experimental data, whereas the phase 
error needs to be estimated or bounded. In the BB84 pro¬ 
tocol with strong symmetries, one can show that e p = 
in the long key length limit. In other protocols, normally 
there is a relation between the two error rates. In the 
end, when the error rate goes beyond some threshold 
level, no secure key can be generated. For example, with 
the Shor-Preskill security proof DHL the BB84 protocol 
can maximally tolerate 11% error rate. For any security 
analysis, a simple intercept-and-resend attack [3] shows 
that the BB84 protocol cannot tolerate more than 25% 
error rate. This threshold puts a stringent requirement 
on the system environment, which makes some practical 
implementations challenging. 

Recently, Sasaki et al. proposed a round-robin differen¬ 
tial phase-shift (RRDPS) QKD protocol [4]. The sender 
Alice encodes a random phase, chosen from {0,7r}, on 
each of L pulses, with an average photon number of 
fi. Upon receiving the L-pulse block, the receiver Bob 


implements a single-photon interference with an Mach- 
Zehnder interferometer (MZI), as shown in Fig. Ek The 
key point is that Bob can randomly adjust the length 
difference of the two arms of the MZI. After obtaining a 
detection click, Bob first identifies which two pulses in¬ 
terfere and then announces the corresponding indices i, j 
to Alice. Alice can derive the relative phase between the 
two pulses as the raw key, and Bob can record the raw 
key from the measurement results. The phase error rate 
e p depends only on the number of photons in the L-pulse 
signal and L, not the bit error rate e&. By setting a large 
enough L, the phase error rate tends to 0 and hence the 
scheme can tolerate up to 50% bit error rate according 
to Eq. ([]]). 

In the protocol, Bob needs to randomly adjust the 
length difference between the two arms of the MZI, from 
1 to L — 1 pulse periods. Based on the current tech¬ 
nology, however, it is challenging to quickly change the 
length difference of the two arms in an MZI. The main 
adjust-delay method is to utilize optical switches, which 
cannot provide both high speed and low insertion loss 
simultaneously. 

In this Letter, we propose an alternative scheme that 
passively chooses two pulses to interfere with the same bit 
error tolerability. When Bob receives a block from Alice, 
he prepares a local L-pulse reference in plain phases, i.e., 
all phases are encoded at phase 0. This L-pulse reference 
interferes with the L-pulse signal sent by Alice on a beam 
splitter, as shown in Fig.[]J. For each block, Bob records 
the status of his two detectors with timestamps, i and j. 

If Bob’s reference is in phase with Alice’s signal, the 
whole setup is essentially a huge MZI. Any detection sig¬ 
nal at time slot i will tell the phase difference between 
i and the phase reference. Then the encoding bit value 
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FIG. 1. (a) Original RRDPS scheme [4 . VDL stands for 
variable delay line. Bob splits the received signals into two 
paths and applies a variable delay r to one of the paths, (b) 
Equivalent model. Bob obtains a click at position i, generates 
two random numbers r G {1, • • • ,L — 1} and b G {0,1} to 
obtain j — z + (— l) 6 r, and publicly announces i and j to 
Alice, (c) Passive RRDPS scheme. Bob uses a local laser to 
generate an L-pulse reference, which interferes with Alice’s 
L-pulse signal. Bob then records the coincidence clicks. 


can be revealed to Bob. Here, Bob requires a phase refer¬ 
ence from Alice, which may require complicate frequency 
comb technology [5|. 

The phase reference is not necessary requirement for 
our scheme though. If Bob’s phase reference is random 
comparing to Alice’s signal, the interference is no longer 
a Mach-Zehnder type but a Hong-Ou-Mandel type [Sj. 
Let us consider a simple case when both Alice and Bob 
each has exactly one photon in their L-pulse trains. The 
states of Alice and Bob can be represented by 

7zi { - ir ' 410 >- 7lp m (2) 

respectively, where Si G {0,1} designates the phase of Al¬ 
ice’s i-th pulse. Since there are two photons in a block, 
one from Alice and one from Bob, Bob would obtain 
at most two detection clicks. He post-selects to choose 
the block where there are exactly two detections and an¬ 
nounces their positions i and j (if i = j, the detection 
result is discarded). The raw key is the relative phase 
between these two pulses in the L-pulse signal. Alice can 
derive this phase difference from her record. 

After the interference and Bob’s post-selection, the 
quantum state at the two detectors becomes one of 

(i_ ( _i )Si +^ K t c t|o), (i~(-ir^hRt| 0) , 

(i + (-i) s *+^)ct c t|o), (i + (-i) si+s o4Ai°)’ 



FIG. 2. Experiment setup. ATT: attenuator; IM: intensity 
modulator; BS: polarization maintaining beam splitter; PM: 
phase modulator; Delay: optical adjustable delay line; PC: 
polarization controller; PBS: polarization beam splitter (sin¬ 
gle mode to polarization maintaining); Det: detector. The 
attenuation on Bob’s side is realized by a polarization con¬ 
troller and a polarization beam splitter. 


where cj and d\ are the creation operators at the two 
detectors respectively, as shown in Fig. [TJ 3 . This means if 
Alice’s pulses i and j have the same phase, i.e., Si = Sj , 
the two clicks should be triggered by the same detec¬ 
tor. While if Alice’s pulses i and j have different phases, 
the two clicks should be triggered by different detectors. 
Thus Bob can derive the relative phase by comparing the 
measurement results of the i-th and j -th pulses. 

For the security analysis, we show that in the single 
photon case, our protocol is equivalent to an intermedi¬ 
ate model shown in Fig. Ef i, which is then equivalent 
to the RRDPS protocol. Thus the phase error e p is also 
bounded by 1/(L — 1) as in RRDPS. Bob post-selects 
the block where two clicks happen at i and j, but he 
cannot distinguish whether the photon causing the click 
belongs to the signal (Alice) or to the reference (Bob). 
Suppose Bob’s photon is at i; the other case is similar. 
Since the L-pulse reference of Bob has a symmetry among 
all pulses, the L — 1 possible positions of Bob’s photon 
i (excluding the position of Alice’s photon, j ) have the 
same weight. Bob has passively chosen a random shift 
r = j — i between the clicks i and j, which is equivalent 
to the active shift in the raw model, as shown in Fig.[l^i. 
We give a strict proof of this equivalence in the Supple¬ 
mental Material, by showing that for any single photon 
input to Bob, the output, which is the distribution of 
the detection event (i, j), remains the same for both our 
protocol and the raw model. 

In practice, a single-photon state source is often re¬ 
placed by a weak laser pulse, which can be described 
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by a coherent state. Alice generates a coherent state 
pulse, randomizes its phase, and divides it into a series 
of weaker coherent state pulses using, say, beam split¬ 
ters. Alice can also generate the pulse train directly, say 
by modulating a continuous-wave laser, with the same 
phase, which we called overall phase. This state prepa¬ 
ration is the same for Bob. When the overall phase is 
randomized, it is shown that the state of the whole pulse 
train can be described by a statistical mixture of Fock 
states, whose photon number follows a Poisson distribu¬ 
tion [7]. Similar to the single-photon case, Alice’s key 
information is encoded into the relative phases between 
pulses. 

In this coherent-state scenario, it is possible to have 
multi-photon components in both Alice and Bob’s re¬ 
spective pulse trains, which will invariably alter Bob’s 
post processing strategy. If Bob gets two or more detec¬ 
tor clicks in a block, he randomly chooses two timestamps 
i and j of detector clicks and announces them. Other¬ 
wise, he discards the result. In this way, Bob can figure 
out the phase difference between i and j as in the single 
photon protocol. By dividing into cases, one can bound 
e p for the coherent-state protocol. Detailed analysis can 
be found in Supplemental Material. 

Meanwhile, the multi-photon components may cause 
a large inherent bit error rate. Imagine the case where 
Alice sends nothing (or photons are lost in the channel) 
and Bob sends 2 photons, it might result in a false con¬ 
clusive detection event. The bit error rate in this case is 
clearly 50%. Since the probability of two single photons 
from each side (which does not have any inherent error) 
is the same as the probability of multi-photon from one 
arm and nothing from the other, the total inherent bit 
error rate will be 25%. 

Our passive RRDPS scheme has three possible types of 
implementations: single-photon case, phase-locked weak 
coherent state, phase-randomized weak coherent sate. 
The third case is the most practical, which does not needs 
any fancy phase-locking technology, single photon source 
or high-speed optical switches. We then provide a proof- 
of-principle experiment demonstration for the third case. 

The experiment setup is shown in Fig. [2] On Alice’s 
side, a tunable extra cavity diode laser with a central 
wavelength of 1550.14 nm and a line-width of 50 kHz is 
modulated into a pulse train with a repetition frequency 
500 MHz. A beam splitter (BS) is used to separate the 
pulse train into two beams, one is for Alice’s encoding 
and the other one is sent to Bob as a reference. Alice 
encodes random {0, i r} phase into each individual pulse 
of the pulse train with a 10 GHz modulator, driven by 
a pulse pattern generator. The pulse pattern generator’s 
random signal is generated beforehand by a quantum ran¬ 
dom number generator. Before sending the pulse train to 
the channel, Alice attenuates the average photon number 
per pulse into 0.004. The signal light goes through the 
channel of a fiber spool to Bob. 


On Bob’s side, he first attenuates his reference pulse 
intensity into an average photon number /i = 0.004 per 
pulse, and then interferes with the reference pulse on a 
BS. Before the BS, a tunable fiber delay line and some 
fixed fiber delay are used to guarantee that the two pulse 
trains arrive at the BS simultaneously. Meanwhile, two 
polarization controllers and polarization beam splitters 
are used to make the two beams’ polarization identical. 

The output ports of the BS are led to two up- 
conversion single photon detectors. The up-conversion 
detector uses sum-frequency generation in a periodically 
poled lithium niobate (PPLN) with a 1.94 fi m pump 
beam to convert the telecom-band photons to 860 nm, 
where they are detected by a silicon single-photon detec¬ 
tor. This scheme benefits from the high detection effi¬ 
ciency and short dead time of the silicon detector, and 
the long-wave pump technology j8] as well as the volume 
bragg gratings (VBG) help to reduce the noise dramati¬ 
cally [9]. The detectors used in our experiment both have 
efficiencys larger than 14%, a dead time less than 80 ns, 
and a dark count 500 Hz. 

We utilize a time digital converter (TDC) to record the 
detection signal. The TDC has a timing resolution of 160 
ps and is synchronized with the pulse pattern generator 
by sharing the same clock. The TDC will time tag and 
memorize all the events and sent to a PC for analysis. 

The final key rate formula is similar to the BB84 pro¬ 
tocol PQ, 


K = N(1-H pa -H ec ), (4) 


where N stands for the length of sifted key and Pec = 
/ • H(eb) accounts for the cost of error correction. Here, 
denote e& to be the bit error rate, and / to be the error 
correction efficiency. For simplicity, we use / = 1 in the 
following postprocessing. 

The privacy amplification cost is Ppa = H(e p ) x (i + 
1.9S^/s/N) where e p is the phase error rate and the sec¬ 
ond factor accounts for finite key effects. Here s comes 
from the security parameter 2 _s , a typical value of which 
is 100. To estimate the phase error rate, we set a proper 
photon number threshold v t h , which is a parameter to be 
optimized. For an L-pulse signal containing more than 
v t h photons, we assume these photons as tagged and the 
corresponding e p = 1/2, that is, Eve can get all infor¬ 
mation about them. For a signal containing less than v t h 
photons, we can effectively bound the leaked information 
by estimating its phase error rate (see Part II of Supple¬ 
mental Material). Let e src (v t h) = Pr(n > v t h) be the 
probability of this, where n is the photon number of the 
L-pulse signal. The phase error is calculated by 
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where Q is the gain of the experiment given by N em /N. 
Here N em is the total number of blocks, N is the number 
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of blocks after Bob’s post-selection, m is the total num¬ 
ber of photon counts of one detector and M is the total 
number of pulses. 

The three additive terms in the phase error correspond 
to the probability of more than v t h photons, the proba¬ 
bility of less than v t h photons and the probability that 
two or more photons simultaneously enter the same de¬ 
tector at the same timestamp. Note that one factor 2 in 
the denominator of (1 — (|yrf ) Vth )/^ is because the phase 
error rate is 0 when the two clicks that Bob announces 
are both from the signal or both from the reference, and 
this probability is at least as large as the probability that 
one such click comes from the signal and the other from 
the reference. By choosing a proper value of v t h , one can 
minimize the cost of privacy amplification. The detailed 
discussion is referred to the Supplemental Material. 

The final key rate depends on the block length L. 
Given the laser intensity of every pulse and the trans¬ 
mission distance, there exists an optimal L for the key 
rate. On Alice’s side, instead of setting a fixed L, we 
modulate the CW laser to form a continuous sequential 
pulse train, like the DPS QKD experiment uni E]. Dur¬ 
ing the postprocessing step, we can choose an optimal L 
by maximizing the final key rate, as shown in Fig. [3] 



FIG. 3. The dependence of the key rate on the block size L 
at various distances. For each distance, we repeat the experi¬ 
ment by 10 times and take the standard deviations in 10 trials 
as the error bar. 

The experimental parameters with the optimal L are 
listed in Table H 

The above analysis does not consider the dead time. 
We discount its effect by post-selecting: immediately af¬ 
ter one detector click, we effectively disable the other 
detector within one dead time period by post-selecting 
out this period. The exact treatment is referred to the 
Supplemental Material. 

In summary, we demonstrate a passive scheme to sub¬ 
stitute the original RRDPS protocol and our system can 
distill a secure key with a bit error rate of 28% in the lab. 


TABLE I. List of optimal L, v t h , and e p h for various dis¬ 
tances. 


d(km) 

l [i 

optimal L 

Vth &ph 

10 

0.004 

8192 

57 0.275 0.00359 

15 

0.004 

16384 

99 0.271 0.00311 

20 

0.004 

16384 

100 0.283 0.00312 

35 

0.004 

32768 

179 0.276 0.00278 

53 

0.004 

131072 

625 0.312 0.00240 


With our scheme, one can easily achieve a large number 
L (say, L = 2 14 ) of pulse train in experiment. In the 
original scheme, the pulse train length L needs to op¬ 
timized before the experiment, which requires a precise 
calibration of the system. In our scheme, on the other 
hand, the parameter L can be decided during postpro¬ 
cessing step, which has an advantage in the case with 
large environment fluctuations. 

The inherent error can be removed by a post-selecting 
technique [12] combined with the recently developed 
discrete-phase-randomization scheme for the coherent 
states [15] . In principle, with certain modifications, such 
technique can be used in our scheme. This is an interest¬ 
ing prospective research project. Meanwhile, the inher¬ 
ent error can be removed by using phase-locked coherent 
state. Note that if Alice sends a strong laser pulse to 
Bob as reference and Bob directly uses it as for inter¬ 
ference, Eve may implement a man-in-the-middle attack. 
One solution to remove this potential threat is to utilize 
frequency comb based frequency distribution technology 

03 ] • 

In future, a field test of the passive RRDPS scheme 
with two independent lasers can be realized by the tech¬ 
nology developed in a recent QKD experiment [15] . With 
low-jitter and high-efficiency single photon detectors HU, 
a much higher secure key rate with a 10 GHz clock rate 
system m can be achieved. 


Acknowledgments 

The authors would like to thank Yan-Lin Tang, Xiao 
Yuan and Zhen Zhang for enlightening discussions. This 
research has been supported by the National Basic 
Research Program (under Grant No. 2011CB921300, 
2013CB336800 and 2011CBA00300), the National Natu¬ 
ral Science Foundation of China, the Chinese Academy of 
Science, and the Shandong Institute of Quantum Science 
& Technology Co., Ltd. 


* xma@tsinghua.edu.cn 
^ qiangzh@ustc.edu.cn 














5 


[1] P. W. Shor and J. Preskill, Phys. Rev. Lett. 85, 441 

( 2000 ), 

[2] H.-K. Lo and H. F. Chau, Science 283, 2050 (1999), 
http: / / www. sciencemag. org / content /283/5410/2050. full .pdf 

[3] C. H. Bennett and G. Brassard, in Proceedings of the 
IEEE International Conference on Computers, Systems 
and Signal Processing (IEEE Press, New York, 1984) pp. 
175-179. 

[4] T. Sasaki, Y. Yamamoto, and M. Koashi, Nature 509, 

475 (2014). 

[5] R. K. Shelton, L.-S. Ma, H. C. Kapteyn, M. M. Murnane, 

J. L. Hall, and J. Ye, Science 293, 1286 (2001). 

[6] C. Hong, Z. Ou, and L. Mandel, Physical Review Letters 
59, 2044 (1987). 

[7] H.-K. Lo, X. Ma, and K. Chen, Phys. Rev. Lett. 94, 
230504 (2005) 

[8] J. S. Pelc, L. Ma, C. Phillips, Q. Zhang, C. Langrock, 

O. Slattery, X. Tang, and M. Fejer, Optics express 19, 
21445 (2011). 

[9] G.-L. Shentu, J. S. Pelc, X.-D. Wang, Q.-C. Sun, M.-Y. 
Zheng, M. M. Fejer, Q. Zhang, and J.-W. Pan, Opt. 


Express 21, 13986 (2013) 

[10] H. Takesue, S. W. Nam, Q. Zhang, R. H. Hadfield, 
T. Honjo, K. Tamaki, and Y. Yamamoto, Nature pho¬ 
tonics 1, 343 (2007). 

[11] K. Wen, K. Tamaki, and Y. Yamamoto, Phys. Rev. Lett. 
103,170503 (2009) 

[12] X. Ma and M. Razavi, Phys. Rev. A 86, 062319 (2012) 

[13] C. Zhu, Z. Zhen, L. Hoi-Kwong, and X. Ma, (2014), 
arXiv:1410.3217vl 

[14] K. Predehl, G. Grosche, S. Raupach, S. Droste, O. Terra, 
J. Alnis, T. Legero, T. Hansch, T. Udem, R. Holzwarth, 
et al ., Science 336, 441 (2012). 

[15] Y.-L. Tang, H.-L. Yin, S.-J. Chen, Y. Liu, W.-J. Zhang, 
X. Jiang, L. Zhang, J. Wang, L.-X. You, J.-Y. Guan, D.- 
X. Yang, Z. Wang, H. Liang, Z. Zhang, N. Zhou, X. Ma, 
T.-Y. Chen, Q. Zhang, and J.-W. Pan, Ieee Journal of 
Selected Topics in Quantum Electronics 21 , (2015). 

[16] F. Marsili, V. Verma, J. Stern, S. Harrington, A. Lita, 
T. Gerrits, I. Vayshenker, B. Baek, M. Shaw, R. Mirin, 
et al ., Nature Photonics 7, 210 (2013). 


